patch 9.2.0746: NULL pointer dereference in gui_photon

Problem:  NULL pointer dereference in gui_photon (Ao Xijie)
Solution: after realloc() validate the buffer is not NULL.

closes: #20661

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/gui_photon.c b/src/gui_photon.c
index 8cc31d59adb5807f377ecc13fa74c4ad0addd4fb..096f6ac54c2e6508bb3fb8fc53dcff07cfe1e1e8 100644 (file)
--- a/src/gui_photon.c
+++ b/src/gui_photon.c
@@ -2173,7 +2173,11 @@ gui_mch_draw_string(int row, int col, char_u *s, int len, int flags)
        // Use a static buffer to avoid large amounts of de/allocations
        if (utf8_len < len)
        {
-           utf8_buffer = realloc(utf8_buffer, len * MB_LEN_MAX);
+           char *new_buffer = realloc(utf8_buffer, len * MB_LEN_MAX);
+
+           if (new_buffer == NULL)
+               return;
+           utf8_buffer = new_buffer;
            utf8_len = len;
        }
 

diff --git a/src/version.c b/src/version.c
index c75668400bc0aa0b42782c6eb04fab9a4bb4118f..bb33fb77c0b4063f563185ce5536d9d2312f2664 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    746,
 /**/
     745,
 /**/